How to use Django’s Content Security PolicyLink to this heading

Basic configLink to this heading

To enable Content Security Policy (CSP) in your Django project:

Add the CSP middleware to your MIDDLEWARE setting:

Code

MIDDLEWARE = [
    # ...
    "django.middleware.csp.ContentSecurityPolicyMiddleware",
    # ...
]

Configure the CSP policies in your settings.py using either SECURE_CSP or SECURE_CSP_REPORT_ONLY (or both). The CSP Settings docs provide more details about the differences between these two:

Code

from django.utils.csp import CSP

# To enforce a CSP policy:
SECURE_CSP = {
    "default-src": [CSP.SELF],
    # Add more directives to be enforced.
}

# Or for report-only mode:
SECURE_CSP_REPORT_ONLY = {
    "default-src": [CSP.SELF],
    # Add more directives as needed.
    "report-uri": "/path/to/reports-endpoint/",
}

Nonce configLink to this heading

To use nonces in your CSP policy, beside the basic config, you need to:

Include the NONCE placeholder value in the CSP settings. This only applies to script-src or style-src directives:

Code

from django.utils.csp import CSP

SECURE_CSP = {
    "default-src": [CSP.SELF],
    # Allow self-hosted scripts and script tags with matching `nonce` attr.
    "script-src": [CSP.SELF, CSP.NONCE],
    # Example of the less secure 'unsafe-inline' option.
    "style-src": [CSP.SELF, CSP.UNSAFE_INLINE],
}

Add the csp() context processor to your TEMPLATES setting. This makes the generated nonce value available in the Django templates as the csp_nonce context variable:

Code

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "OPTIONS": {
            "context_processors": [
                # ...
                "django.template.context_processors.csp",
            ],
        },
    },
]

In your templates, add the nonce attribute to the relevant inline <style> or <script> tags, using the csp_nonce context variable:

Django template

<style nonce="{{ csp_nonce }}">
  /* These inline styles will be allowed. */
</style>

<script nonce="{{ csp_nonce }}">
  // This inline JavaScript will be allowed.
</script>

How to use Django’s Content Security PolicyLink to this heading#

Basic configLink to this heading#

Nonce configLink to this heading#

How to use Django’s Content Security PolicyLink to this heading

Basic configLink to this heading

Nonce configLink to this heading